[Abstract] This paper introduces the hardware structure, control functions, peripheral sensing elements, electro-hydraulic servo valve structure and operating principle of the dual-microcomputer speed governor, and provides a comprehensive evaluation of its design and operation. [Keywords] Dual-microcomputer speed governor structure, function, angle transmitter, electrical protection 1 Overview of power plant speed governor Ertan Hydropower Plant is located in Panzhihua City, Sichuan Province, on the lower reaches of the Yalong River. Ertan Hydropower Plant has six 550MW units, with a total installed capacity of 3300MW and an average annual power generation of 17 billion kWh. It was the largest hydropower plant built and put into operation in China at the end of the 20th century. The first unit was put into operation on August 18, 1998, and the entire power plant was completed and put into operation on December 4, 1999. The governor cabinets and control cabinets for all six generating units at the Ertan Hydropower Plant were manufactured by HYDROVEVEY of Switzerland, while metal components (such as oil collection tanks and servo drives) were manufactured by GE of Canada. The hardware and software of the dual-microcomputer governors are products of HYDROVEVEY, Switzerland, and, after system setup and software development by the company, have become European standard products. The governor electrical control cabinets are installed in the generator unit control room, while the mechanical control cabinets and hydraulic pressurization devices are located on the turbine level. 2. System Structure and Composition of the Microcomputer Governor The electrical control cabinet for the microcomputer speed governor at Ertan Hydropower Plant consists of a control panel and an operating panel. The upper part of the control panel houses speed governors 1 and 2, while the lower part contains a protected AI terminal block, a creep monitoring relay, a network frequency signal filter, an analog signal electromagnetic isolator, a fault switching relay for speed governors 1 and 2, and an active power converter. An emergency stop button is mounted on the control panel. The upper part of the operating panel contains various functional relays, while the lower part houses a 220VDC power switching block, an AC/DC power switch, and auxiliary terminal blocks. 1. 220VDC/240VDC; voltage converter. The upper part of the control panel is equipped with indicators for unit speed, guide vane position, active power, permanent slip coefficient, frequency supply, opening limit, power supply, artificial dead zone, and grid frequency. The middle part is equipped with a touch screen and switches for frequency supply, power supply, opening limit, control location, guide vane control mode, opening degree-power feedback selection, speed control head selection (1-2), and switching mode selection. The cabinet panel is equipped with indicators for unit speed, opening degree, and opening limit, as well as status indicator lights, opening limit increase/decrease switches, and an emergency stop button. 2.1 System Structure: Dual Microcomputer System Regulator: Dual microcomputers, dual buses, dual input/output channels; essentially, two sets of microcomputer regulators, with identical content but completely independent structures, forming a redundant system that serves as backup for each other. 2.2 System Composition 2.2.1 Turbine Governor Cabinet Configuration (1) Cabinet Body (2200mm×1600mm×800mm) Two cabinets combined (2) Dual DC Power Supply Switching Block 1 piece (3) Input Isolation Component 1 set (4) Relay Assembly 1 set (5) GESBUS G96 Bus Printed Circuit Board 20 pieces in total Among them 1) Processor Plug-in Board GESSBS-6A This board has a 68000 microprocessor with a clock frequency of 16MHz. 2) Memory Plug-in Board GESMEM-12D This plug-in is a general memory plug-in, which is designed to work on the G96 bus with a 16-bit asynchronous processor. 3) Program Control Timer Plug-in Board TIM-536 This plug-in includes up to three program control timers, each timer has three 16-bit counters. It can generate, measure and determine the time interval. 4) D/A Converter Plug-in Board GESDAC-2B This plug-in provides 8 independent D/A converter channels. 5) Switch interface plug-in board GESP-2A This plug-in includes two MC6821I/(3 loops, which allows the microprocessor to communicate with the outside through 40 TTL compatible digital channels. 6) Relay interface plug-in board GESOUT-3 This plug-in can send digital instructions transmitted by the microprocessor to the relay. 7) It has a total of 18 functional plug-in boards. 2.2.2 Software configuration (1) Real-time running software The real-time running software enables the MIPREG-600 turbine governor to have all the adjustment and control functions. At the same time, during the actual operation of the IPREG-600 device, its touch screen can reflect a large amount of operating status, working conditions, parameters and fault information, which makes it convenient for operators to understand the operation of the governor in a timely manner. When the host computer in the central control room is in operation, the MIPREG-600 device exchanges information with the host computer and adjusts and controls according to the instructions issued by the host computer, so as to operate more economically. (2) Debugging software The debugging software consists of two parts: intelligent debugging software and maintenance diagnostic software. • Intelligent commissioning software keeps the device in commissioning mode, helping commissioning personnel to easily and smoothly complete the installation, commissioning, and all speed control system tests. The software greatly simplifies the speed control system testing process, allowing commissioning personnel to easily set and modify various parameters and functions. All test processes are displayed on the PC screen and touchscreen. Static and dynamic test results can be automatically printed and recorded as data and curves. This reduces the workload and labor intensity of commissioning personnel, improves work efficiency, and shortens test time. During commissioning, unless there are special testing requirements, there is no need to connect external testing instruments typically required for speed controller testing. • Maintenance and diagnostic software helps maintenance personnel quickly and accurately understand the working status of the device's hardware and software, pinpoint the fault location on the printed circuit board, and quickly troubleshoot the device. 3. Control Functions of the Microcomputer Speed ​​Controller The Ertan Hydropower Plant's microcomputer speed controller has multiple control functions and operating modes. It mainly employs opening degree control, power control, opening degree limit control, frequency tracking control, and frequency control. Each control mode has its own separate control software, capable of independently regulating and controlling the unit, and they are mutually independent. They are interconnected, and their internal control follows the principle of "minimum parameter selection" for automatic switching (i.e., the signal with the smallest value has the highest priority control). Because effective signal tracking is achieved between the various control methods, switching between methods can be completed smoothly and without disturbance. 3.1 Opening Control Opening control is mainly used for the control of unit startup, shutdown, and the connection of fixed loads after parallel operation. It includes: startup opening control ICYD0, startup opening control IICYD, startup opening control IIICYD2, opening control, and frequency tracking control, etc. After the unit meets the start-up conditions, the governor's start-up solenoid valve activates, and the unit begins to start. The governor first operates on "Start-up Opening I Control CYDO", opening the guide vanes to 0.3 times the no-load opening position. When the unit speed rises to a certain set value (5Hz), it automatically switches to "Start-up Opening II CYD Control", opening the guide vanes to 0.75 times the no-load opening position. When the unit speed rises to a certain set value (20Hz), it automatically switches to "Start-up Opening III CYD2 Control", opening the guide vanes to 1.25 times the no-load opening position. When the unit speed approaches the rated speed, the guide vanes automatically close to the no-load opening position (this no-load opening position is automatically set by the governor based on the real loop head in the head and no-load opening curve). Thus, the entire start-up process ends. Compared with the domestic start-up method of opening the guide vanes to a large opening and then closing them, its advantage is that different opening positions are used at different speed ranges during the start-up process. This allows the unit to quickly, accurately, smoothly, and without overshoot reach its rated speed. After the unit is connected to the grid, the speed governor can adjust the load locally or remotely via speed or power feedback, or automatically adjust according to a predetermined load curve via AGC. 3.2 Speed ​​Control Speed ​​control includes three modes: no-load speed control, grid-connected speed control, and islanded speed control. 3.2.1 No-load speed control is only effective when the generator outlet circuit breaker is open. It mainly functions to start the unit and maintain the unit's speed at its rated speed. 3.2.2 Grid-connected speed control is only effective when the generator is connected to the grid to eliminate frequency anomalies in the system (because the Ertan Hydropower Plant has a large unit capacity and frequency regulation capability in the system). 3.2.3 Isolated Grid Speed ​​Control is a control method designed to handle isolated local loads and large fluctuations in system load. Its operating conditions are: when the output circuit breaker closes and the speed exceeds a predetermined speed deviation (49.5~50.5), it automatically engages, participates in system frequency regulation, and eliminates speed deviations to improve system stability according to the predetermined unit droop rate. 3.3 Power Control: This control requires the generator output circuit breaker to be closed; otherwise, the control will not function. The unit's output power is compared with the external power setpoint via a power transmitter to determine the load carried by the unit, thus maintaining system frequency stability. 3.4 Opening Limit Control: This is a limit control for all control mode signals. When any control mode signal reaches the limit value, the opening limit control will automatically engage to prevent adjustment errors. The software has two separate "opening limit points": start opening limit and opening limit. Its internal control follows the "minimum parameter selection" principle for automatic switching. The opening limit can be adjusted on the control cabinet, or in the electrical cabinet, touch screen, or central control room. The guide vane opening limiter range is -5% to 110%. 3.5 Frequency Tracking Control: Frequency tracking control is essentially speed control. When the unit's starting speed reaches 25%Ne, this mode is activated, and the unit's frequency will automatically and stably track the system frequency to achieve rapid grid connection. In the design, when the unit's frequency tracks to 49.5–51.5Hz (this range is adjustable), the synchronization device automatically engages, and the unit immediately connects to the grid. After grid connection, frequency tracking automatically disengages. 4. Peripheral Equipment of the Microcomputer Speed ​​Controller : 4.1 Speed ​​Detection Unit: The speed measurement system developed by HYDROVEVEY uses two sets of gear disc speed measurement. Each set consists of two fixed magnetic sensors, symmetrically arranged around the main shaft of the unit. Twelve magnets are evenly fixed to the main shaft. The distance between the two sensors is calculated, and the magnetic path time between the two sensors matches the unit's rotation cycle. The number of magnets determines the number of measurements per rotation cycle of the main shaft. When the unit rotates... The magnet rotates with the main shaft, constantly approaching and separating from the stationary sensor sensing surface. The pulses generated by the magnet in the sensor are processed to trigger a counter controlled by a quartz clock. The number of pulses is recorded in the counter, thus obtaining the unit's rotation period. Calculating its reciprocal yields a linear function related to the unit's speed. Two sets of parallel measuring devices are symmetrically installed in the 180° direction. One set is used to compensate for errors caused by the displacement of the main shaft in the bearing clearance, while the other set is provided to a monitoring device. The sensor's operation is corrected by comparing the values ​​obtained from the two circuits. The output of the speed detection unit is introduced into the microcomputer speed controller, serving as the unit's regulation control signal and outputting speed signals through the relay group for power supply overspeed and unit operation control. 4.2 Electrical Feedback Unit: Feedback from the speed controller is a necessary and sufficient condition for the stability of the speed control system. An angle transmitter developed by HYDROVEVEY can transmit angle positions from 0 to 60°. The signal is converted to an electrical signal of 0-5mA, corresponding to the guide vane position as fully closed to fully open. This electrical feedback unit mainly serves as the closed-loop control of the microcomputer speed controller. The Ertan Hydropower Plant's generating units are equipped with two sets of angle transmitters, 71C1 and 71C2. The guide vane relay mechanically drives the angle transmitters through a lever system. The transmitters provide a signal to the speed controller in proportion to the displacement, outputting current. This signal is sent to speed controllers 1 and 2 respectively. When either angle transmitter fails, the speed controller smoothly and seamlessly switches to the normally operating speed controller. At this time, the main fault indicator light on the speed controller and the main fault type display on the touchscreen are activated, and the main fault signal is sent to the central control room. HYDROVEVEY's angle transmitters use a differential rotary transformer for detection. The transformer's rotor induces voltage in the stator. These voltages are rectified positively or negatively, then summed, and a low-pass filter removes noise, resulting in a smooth DC current output by the angle transmitter. The angle transmitters from HYDROVEVEY are characterized by their robustness, durability, vibration resistance, and adaptability to temperature variations. 4.3 Creep Detection Unit: Due to the high operating head of the Ertan Hydropower Plant units, ranging from 135m to 189m, and the long-term operation of the units, even when the unit is shut down and the guide vanes are fully closed, leakage between the guide vane gaps could cause the unit to rotate again. This could potentially lead to accidents such as thrust bearing burnout and other malfunctions. Therefore, a creep detection unit must be installed. After the creep detector detects the unit's rotation, the consequences are immediately to activate the air damper, vent the sump, and start the high-pressure oil pump. The creep detector includes a pulse generator and a static controller. The pulse generator consists of a metal ring fixed to the turbine shaft with 120 holes drilled in it. A pulse is generated each time a hole passes through the detector. The static controller receives the pulses and compares this input frequency with a reference frequency to detect the unit's creep. 4.4 Electro-hydraulic Servo Valve 90C Developed by HYDROVEVEY, the dual-nozzle baffle electro-hydraulic servo valve boasts advantages such as compact structure, high sensitivity, and good linearity. The hydraulic amplification section of this unit is a three-stage hydraulic amplification: electro-hydraulic servo valve (first-stage hydraulic amplification) → second-stage servo valve (second-stage hydraulic amplification) → main pressure distribution valve (third-stage hydraulic amplification). After hydraulic amplification, the pressurized oil (6.0 Me) controls the main servo unit, thereby controlling the movement of the guide vanes. 4.4.1 Structure of the Electro-hydraulic Servo Valve Fixed parts: Permanent magnet fixed to the servo valve seat, two throttling orifices, two nozzles, etc. Moving parts: Coil rigidly connected to the baffle, probe pressed on the second-stage servo valve connecting rod, compression spring, etc. 4.4.2 Operating principle of the electro-hydraulic servo valve The power amplifier output current of the speed controller flows through two flexible metal strips through the coil rigidly connected to the baffle, interacting with the fixed permanent magnet to generate an electromagnetic induction force. The magnitude and direction of this electromagnetic induction force are linearly related to the magnitude and direction of the current. Under stable operating conditions, no current flows through the electro-hydraulic servo valve coil. At this time, the baffle is positioned in the center between the two nozzles, the main pressure distribution valve does not operate, and the main servo motor does not operate. When the speed controller amplifier outputs a shutdown current, this current flows through the coil. Due to the rigid connection between the coil and the baffle, the baffle generates a vertically upward force, causing it to tend to move upwards. As the baffle moves upwards, the oil flow through the lower nozzle increases, while the oil flow through the first nozzle decreases. The oil volume in the upper chamber of the second-stage servo valve increases, and the oil volume in the lower chamber decreases. The piston of the second-stage servo valve therefore moves downwards, the main pressure distribution valve moves downwards, and the guide vane moves in the closing direction. As a result, the upward force exerted by the spring on the baffle decreases. Due to the feedback effect of the guide vane, the speed controller gradually stops regulating. The current in the electro-hydraulic servo valve coil gradually decreases, and the second-stage servo valve stops moving. The baffle returns to its initial position under the action of the spring, i.e., in the center between the two nozzles. The process of opening the guide vane is the reverse of the above. To prevent the first and second stage servo valves, the main distribution valve, and to reduce friction, a 25Hz AC voltage of approximately 0.13V is superimposed on the electro-hydraulic servo valve coil, causing the baffle to vibrate between 0.01 and 0.02mm. This causes the pistons of the second stage servo valve and the main distribution valve to vibrate continuously in their intermediate positions. 4.5 Oil Tank Hydraulic Control Unit: The oil tank is the energy storage component of the governor's hydraulic operating system and must always maintain sufficient oil level and pressure. The Ertan Hydropower Plant's oil tank hydraulic control unit's control system is composed of conventional relay components. Its characteristics are: no common control circuit is used; instead, a one-to-one control method is adopted; that is, one control unit controls only one oil pump motor. When a hydraulic control unit malfunctions and requires power outage maintenance, only the power supply to the faulty unit needs to be disconnected for its control circuit maintenance, without affecting the normal operation of other control units. The oil level and pressure of the oil tank hydraulic control unit are obtained from the sealed liquid level float inside the oil tank, which, after gear transmission, activates the limit switch and the pressure switch connected to the tank body via a steel pipe. 5. Electrical Protection of the Microcomputer Speed ​​Controller The microcomputer speed controller is equipped with a complete real-time program diagnostic and self-diagnostic system. It can respond promptly to internal and external faults such as software system faults, CPU faults, guide vane angle transmitter faults, internal power supply faults, and speed sensor faults. Based on the nature of the fault, it will take the following actions in sequence: 5.1 No switching between speed controllers 1 and 2, only alarm signals are sent: serial port receive error, serial port transmit error, EEPROM write error, etc. 5.2 Switching between speed controllers 1 and 2, and alarm signals are sent: EPR~M verification error, internal electrical fault, guide vane angle transmitter fault, etc. 5.3 Emergency shutdown: loss of dual DC power supply to the speed controller, dual speed controller head fault, etc. 5.4 Emergency shutdown and lowering of the inlet gate: The emergency stop button on the control cabinet activates, the mechanical overspeed (140%Ne) device activates, 140%Ne overspeed (electric speed measurement), and the oil tank detects extremely low oil level and pressure. These comprehensive protection systems effectively ensure the safe and stable operation of the speed control system. 6. Speed ​​Control System Operation The speed control system has different operating requirements under different conditions. 6.1 Operation of the Speed ​​Control System in Test Mode: In test mode, the guide vanes can be opened or closed by operating the electrical limit handle, facilitating the adjustment of the linearity of the guide vane position sensor and the master control contacts. Simultaneously, when the speed controller head is set to test mode, the output relay can be directly activated to detect signal wiring. 6.2 Operation of the Speed ​​Control System in Manual Mode: In manual mode, the speed control system is mainly used for manual startup when water is present. The guide vanes can be closed and opened by increasing or decreasing the electrical limit. Unlike test mode, the guide vanes will not open further once the unit speed reaches the frequency setpoint. 6.3 Operation of the Speed ​​Control System in Automatic Mode: In automatic mode, the speed control system is mainly used for local automatic start-up and frequency tracking, enabling the unit to connect to the grid more quickly. 6.4 Touchscreen Operation: The touchscreen greatly facilitates maintenance personnel's understanding of the unit's operating status and operation of speed control parameters. The touchscreen allows for easy adjustment of analog channels and monitoring of fault status. 6.5 Operation of the Hydraulic Oil Pressurization System: The hydraulic oil pressurization system consists of three main pumps, one auxiliary pump, one oil collection tank, one hydraulic oil reservoir, oil level switches, and pressure switches. During normal operation, the auxiliary pump stops when the oil level change is small; when the oil level change is large and the auxiliary pump cannot meet its oil supply requirements, the main pump of the three main pumps will start; when the oil level drops further, the lagging pump of the three main pumps will start; when the oil level drops further, the standby pump of the three main pumps will start; until the extremely low oil level contact activates and stops the unit. The starting sequence of the three main pumps can be switched periodically via a switch handle to protect the motors. 7. Speed ​​Control System Operation The speed control system operates normally in the following modes: 7.1 Remote/Manual/Power Feedback/Closed-Loop Engagement Mode: In this mode, the difference between the power setpoint of the computer-controlled system and the actual unit output is sent to the speed controller via intermediate relays in the form of pulses. As long as the difference between the power setpoint and the actual unit output is not zero, the computer monitoring system will send pulses of varying lengths to the speed control system. After receiving the pulses, the speed control system converts them into the corresponding power setpoint, compares the power setpoint with the output measured by the speed control system, and adjusts the unit output. 7.2 Remote/Manual/Power Feedback/Closed-Loop Exit Mode: In this mode, the power setpoint of the computer monitoring system is converted into corresponding pulse lengths and sent to the speed controller. After receiving the pulses, the speed control system converts them into the corresponding power setpoint, compares the power setpoint with the output measured by the speed control system, and adjusts the unit output. 7.3 Remote/Manual/Opening Feedback/Closed-Loop Entry Mode: In this mode, the difference between the power setpoint of the computer monitoring system and the actual unit output is sent to the speed governor via pulses through an intermediate relay. As long as the difference between the power setpoint and the actual unit output is not zero, the computer monitoring system will send pulses of varying lengths to the speed governor system. After receiving the pulses, the speed governor system converts them into the corresponding power setpoint, which in turn converts them into the corresponding opening setpoint. The opening setpoint is compared with the guide vane opening measured by the speed governor system to adjust the unit output. 7.4 Remote/Manual/Opening Feedback/Closed-Loop Exit Mode: In this mode, the power setpoint of the computer monitoring system is converted into pulses of varying lengths and sent to the speed governor. After receiving the pulses, the speed governor system converts them into the corresponding power setpoint, which in turn converts them into the corresponding opening setpoint. The opening setpoint is compared with the guide vane opening measured by the speed governor system to adjust the unit output. 7.5 Remote/Automatic/Power Feedback/Closed-Loop Activation Mode: In this mode, the power setpoint value of the computer monitoring system is converted into a corresponding analog quantity and sent to the speed controller. The speed controller converts the analog quantity back into a corresponding power setpoint value, compares this power setpoint value with the output measured by the speed controller, and adjusts the unit's output accordingly.